High riskSocial Media Scams

Fake CAPTCHA Scam

In this scam, a fake CAPTCHA or 'verify you're human' page, often reached via social links or videos, instructs you to press keys or paste a command that secretly installs malware on your device.

Quick verdict

Risk level
High risk
Scam type
Malware delivery (fake verification)
Main red flag
A 'verification' page that asks you to press key combinations or paste a command.
What to do first
Do not follow the steps; real CAPTCHAs never ask you to run commands.

What this scam usually looks like

In this scam, a fake CAPTCHA or 'verify you're human' page, often reached via social links or videos, instructs you to press keys or paste a command that secretly installs malware on your device.

Example message pattern

Example pattern — not a real report
Example pattern: 'To verify you are human, press Windows+R, paste this, and hit Enter.' The command installs malware.

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

Red flags to watch for

  • A CAPTCHA that asks you to press keys or paste a command
  • Instructions to open Run, Terminal, or paste text
  • A page reached via a social link, ad, or video
  • Pressure to complete verification to continue
  • Anything beyond clicking a normal checkbox or image

What to do

  • Never paste commands or press key combinations to 'verify'
  • Close the page; real CAPTCHAs only need a click or image selection
  • Run a security scan if you followed any steps
  • Report the page and avoid the source link

If you already clicked or replied

  • If you ran a command, disconnect from the internet and run a security scan
  • Change important passwords from a different, trusted device
  • Watch for unusual account or device activity
  • Seek help from a trusted technician if needed

What not to do

  • Do not paste commands or run scripts to 'verify'
  • Do not press key combinations a page tells you to
  • Do not ignore it if you followed the steps

Similar scams

High risk Email

Malware Attachment Scam

In a malware attachment scam, an email arrives with a file posing as an invoice, receipt, CV, statement or delivery note. Opening the attachment, or clicking a prompt to 'enable content' or 'enable macros', can quietly install malware that steals passwords, banking logins or files. The message is often crafted to feel urgent or routine so you act before thinking. Treating every unexpected attachment with caution, and verifying it through a separate channel, is one of the most effective defences.
High risk Email

Fake Tech Support Scam

This scam uses a pop-up, email, or phone call warning that your computer is infected or your account is compromised, urging you to call a number or allow remote access, after which the fake 'technician' charges fees, installs software, or takes your data.
High risk Text Message

Tech Support Text Scam

This scam texts that your device is infected, hacked, or compromised and urges you to call a 'support' number, where a fake agent seeks remote access, payment, or your account details.

Frequently asked questions

How is this CAPTCHA different from a real one?
Real CAPTCHAs only ask you to click a box or select images. A 'CAPTCHA' that tells you to press keys or paste a command is delivering malware.
Why does pasting a command matter?
The command runs on your device and can install malware that steals passwords and data. Never paste commands to 'verify you are human'.
I followed the steps. What now?
Disconnect from the internet, run a security scan, change important passwords from a trusted device, and watch for unusual activity.
Where do these pages come from?
Often via social links, ads, or video descriptions. Be cautious with verification pages reached from untrusted sources.

Last reviewed: June 2026

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.